Description
The Colissimo Officiel : Méthodes de livraison pour WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the updateShippingMethod() function (registered to the wp_ajax_lpc_order_affect AJAX action) in versions up to, and including, 2.9.0. This is due to the handler performing no current_user_can() capability check and no nonce verification before reading an attacker-supplied order_id and modifying that order's shipping method, pickup-point meta, and shipping address. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create or modify the shipment information (shipping method, pickup relay data, and shipping address) of arbitrary WooCommerce orders, including orders placed by other users.
Published: 2026-07-09
Score: 4.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The Colissimo Officiel : Méthodes de livraison pour WooCommerce plugin allows an authenticated user with Subscriber or higher privileges to modify the shipping method, pickup‑point metadata, and shipping address of any WooCommerce order because the wp_ajax_lpc_order_affect handler performs no capability check or nonce verification before applying the changes. This is a classic Missing Access Control flaw (CWE-862) that can change how a customer’s order is shipped, potentially causing financial loss or operational disruption.

Affected Systems

WordPress sites running the iscpcolissimo Colissimo shipping methods for WooCommerce plugin version 2.9.0 or earlier are affected. Any user with Subscriber‑level access or higher can trigger the vulnerable Ajax action to alter shipping details of arbitrary orders.

Risk and Exploitability

The CVSS score of 4.3 indicates moderate severity, while the EPSS score of less than 1 % suggests a very low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Because the flaw requires authentication via Ajax and does not provide code execution, the impact is limited to the modification of shipping data, which can still cause financial or reputational damage for the site owner.

Generated by OpenCVE AI on July 26, 2026 at 15:43 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update to the latest version of the Colissimo shipping methods for WooCommerce plugin, where proper capability checks and nonce validation have been added for the wp_ajax_lpc_order_affect action.
  • If an update cannot be performed immediately, restrict the wp_ajax_lpc_order_affect endpoint so that only administrators or dedicated roles can access it, for example by adding a capability requirement or using a role‑management plugin to block Subscriber access.
  • Continuously monitor order logs for unexpected changes to shipping methods or pickup‑point data, and audit order histories regularly for signs of abuse.

Generated by OpenCVE AI on July 26, 2026 at 15:43 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 10 Jul 2026 10:15:00 +0000

Type Values Removed Values Added
First Time appeared Iscpcolissimo
Iscpcolissimo colissimo Shipping Methods For Woocommerce
Wordpress
Wordpress wordpress
Vendors & Products Iscpcolissimo
Iscpcolissimo colissimo Shipping Methods For Woocommerce
Wordpress
Wordpress wordpress

Thu, 09 Jul 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 09 Jul 2026 10:45:00 +0000

Type Values Removed Values Added
Description The Colissimo Officiel : Méthodes de livraison pour WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the updateShippingMethod() function (registered to the wp_ajax_lpc_order_affect AJAX action) in versions up to, and including, 2.9.0. This is due to the handler performing no current_user_can() capability check and no nonce verification before reading an attacker-supplied order_id and modifying that order's shipping method, pickup-point meta, and shipping address. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create or modify the shipment information (shipping method, pickup relay data, and shipping address) of arbitrary WooCommerce orders, including orders placed by other users.
Title Colissimo Officiel : Méthodes de livraison pour WooCommerce <= 2.9.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Order Shipment Modification via lpc_order_affect AJAX action
Weaknesses CWE-862
References
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'}

Subscriptions

Iscpcolissimo Colissimo Shipping Methods For Woocommerce
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-07-09T14:37:58.884Z

Reserved: 2026-05-21T18:54:54.933Z

Link: CVE-2026-9240

cve-icon Vulnrichment

Updated: 2026-07-09T14:37:54.860Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-26T15:45:08Z

Weaknesses